Summary
A critical vulnerability chain targeting LiteLLM, one of the most popular open-source AI gateway and proxy servers, has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog with a federal remediation deadline of June 22, 2026. The primary flaw, CVE-2026-42271, is a command injection vulnerability in LiteLLM’s Model Context Protocol (MCP) test endpoints that allows any authenticated user — even those with low-privilege API keys — to execute arbitrary commands on the host.
The severity escalates dramatically when chained with CVE-2026-48710, an authentication bypass in the Starlette web framework (a LiteLLM dependency). Together, these two vulnerabilities enable fully unauthenticated remote code execution with a combined CVSS score of 10.0. Successful exploitation can lead to theft of master API billing keys, exfiltration of internal prompts and source code, and root access — especially in Docker deployments running as root.
LiteLLM versions 1.74.2 through 1.83.6 are affected. The fix requires upgrading to LiteLLM 1.83.7+ and ensuring the Starlette dependency is at version 1.0.1 or higher.
Sources
- NVD — CVE-2026-42271
- Cloud Security Alliance — LiteLLM CVE-2026-42271 analysis
- Security Affairs — CISA adds LiteLLM to KEV catalog
Commentary
This is exactly the kind of vulnerability that keeps AI infrastructure teams up at night. LiteLLM sits in the critical path between applications and LLM providers, handling API keys, billing, and prompt routing. An unauthenticated RCE in that position means an attacker can compromise every downstream model interaction — stealing API keys, exfiltrating prompts that may contain sensitive business logic or customer data, and pivoting deeper into the infrastructure.
The root cause is particularly instructive: MCP test endpoints that were never meant for production exposure but accepted full server configurations including command execution parameters. It’s a classic case of debug/test functionality becoming a gaping hole in production. With CISA’s remediation deadline now passed, any organization still running affected versions should treat this as an active emergency. The broader lesson for the AI infrastructure space is clear — every proxy, gateway, and orchestration layer in the LLM stack needs the same security scrutiny we apply to traditional web infrastructure.